Why your emails land in spam, and what to fix first: SPF, DKIM, DMARC and limits

When your mail lands in a recipient's spam folder, the cause is rarely a mystery. Deliverability comes down to four things: authentication, how you send, what you send and your domain's reputation. Work through them in that order, because the first two account for most cases.

Start with authentication

Receiving servers check whether you are authorised to send as your domain. A domain that fails these checks is filtered almost everywhere, so fix this before anything else.

Three records do the work:

• SPF lists which servers may send as your domain.
• DKIM signs your messages so receivers can verify them. You enable it per domain under cPanel → Email Deliverability.
• DMARC tells receiving servers what to do with mail that fails SPF and DKIM, and asks them to report back.

Open cPanel → Email Deliverability first. It validates all three and shows what is wrong. If it reports a problem, nothing else you change will matter much.

Set your SPF record

Every message sent from a WebGee account leaves through a dedicated outbound relay, MailBaby, rather than your server's own IP. That relay has to be authorised in your SPF record, or every message fails SPF.

1. In cPanel, open Email Deliverability under Email.
2. Find your domain and select Manage.
3. If your DNS is hosted in cPanel, select Install The Suggested Record. If it is hosted elsewhere, such as Cloudflare or your registrar, copy the suggested value and create a TXT record there.

A WebGee SPF record looks like this:

If you also send from other services, add each one to the same record. A domain must have exactly one SPF record: two records is a permanent error, and receivers treat it as no SPF at all. SPF also allows a maximum of 10 DNS lookups, and each include: costs at least one. Going over produces permerror, which fails exactly like having no record.

The full walkthrough is in Set your SPF record.

Enable DKIM, then publish DMARC

Enable DKIM on the same Email Deliverability page. Check that both SPF and DKIM show as valid before you add DMARC. A DMARC record on a domain without working SPF will start failing your own legitimate mail.

To add DMARC, select Manage beside your domain, scroll to the DMARC section and select Install The Suggested Record. The suggested record is monitoring only, which is the right place to start. Add a reporting address so you receive aggregate reports:

Tighten the policy in stages. Once reports show only illegitimate sources failing, move to p=quarantine, which delivers failures to spam. When you are confident, move to p=reject, which refuses them outright. Do not start at p=reject: marketing platforms, invoicing systems, CRMs and helpdesks commonly send as your domain, and any not covered by SPF and DKIM stop being delivered with no bounce you will see.

See Publish a DMARC record for adding the record by hand in the Zone Editor and reading the reports.

Send the right way

Authenticate over SMTP. Sending without authentication adds points to the spam score immediately. In your mail client, make sure My outgoing server requires authentication is enabled and uses the same username and password as incoming mail. Check this even if you believe it is already on, because some clients silently drop the setting when a password changes. See Fix "550 Please turn on SMTP Authentication".

Do not use PHP mail(). It relays via the server hostname while your application claims a different From address, and receivers read the mismatch as spoofing. Configure your application or WordPress site to send over SMTP with a real mailbox instead. See Enable PHP mail().

Send from an address on your own domain. A From address such as [email protected] sent from your server fails alignment.

Watch your content

Spam scoring reacts to recognisable patterns. In a legitimate message, one or two are usually responsible:

• Subject lines in capitals, or heavy exclamation marks
• Bulk-mail phrasing such as "act now", "limited time" or guaranteed returns
• A message that is one large image with almost no text
• Shortened links such as bit.ly, which hide the destination. Use the full URL.

Understand the 550 spam rejection

WebGee scans outbound mail before it leaves. Anything scoring above the threshold is returned to you rather than sent, with this bounce: 550 This message was classified as SPAM and may not be delivered

This protects the shared sending reputation. The most common cause is a mail client sending without SMTP authentication, which can push an otherwise ordinary message over the threshold. Fix that first, then look at the content signals above, reword and resend. If the message goes through, the content was the cause.

If ordinary messages keep failing after you have checked authentication and content, open a ticket with the full bounce message and the message headers. See Fix "550 This message was classified as SPAM".

Stay within your sending limits

Outbound mail is limited per domain per hour, depending on your plan. Limits range from 150 messages per hour on plans such as Infinity Hosting and cPanel Reseller Hosting, to 250 on WebGee Workspace and Premium Hosting — Business, and up to 500 on Premium Hosting — Platinum. There is no daily limit. A 25% overage buffer queues messages above the hourly threshold rather than rejecting them; beyond that, outbound attempts are rejected.

Everything your account sends counts: mail apps, webmail, contact forms, order confirmations, password resets and mailing list traffic. A busy WooCommerce store can use a meaningful share of the limit on transactional mail alone.

Automatic monitoring sends a notification, and may apply a block, when an account sends to 250 or more recipients in one hour or more than 500 messages in 24 hours. If you receive one of these notices and were not sending in bulk, treat it as a possible compromise: change the mailbox password and check Track Delivery in cPanel.

Marketing email is not permitted on WebGee's mail facilities. Use a service built for campaigns, such as Mailchimp, SendGrid or Brevo. If you are hitting the limit with legitimate mail, route your application's mail through a third-party SMTP relay or move to a plan with a higher limit. The full table is in Email sending limits.

Protect your domain's reputation

Because outbound mail routes through a dedicated, monitored relay, your sending IP's reputation is largely handled for you, and a neighbour's problems do not become yours. It also means a dedicated IP does not improve deliverability. See How outbound mail is relayed.

Your domain's reputation is yours to look after. It is damaged by a compromised mailbox sending spam, by sending to purchased or scraped lists, and by high complaint rates from recipients marking mail as spam.

Diagnose a specific message

When one message was filtered, get its full headers. In WebGee webmail, open the message, select the ⋮ menu and then View Source. In Gmail, use Show original.

The Authentication-Results header shows whether SPF, DKIM and DMARC passed, and X-Spam-Score or X-Spam-Status shows how close the message came. That tells you whether you have one problem or several. When you contact support, paste the whole header block as text, not a screenshot.

Instructions for Outlook, Apple Mail and Thunderbird are in Get the full headers of an email.

Track delivery in the Mail Delivery Center

The Mail Delivery Center shows what happened to your outbound mail after it left the server. Its Email Deliverability page compares your delivery rate to Gmail, Microsoft, Yahoo/AOL and other providers, day by day, and lists which of your sending domains is behind a problem, including whether each has a DMARC record.

A gradual decline across weeks usually means reputation. A sudden drop on one day points at a change made that day, such as a new sending application, a bought list, a compromised mailbox or a DNS change. See Email deliverability.